[arch-general] CVE-2021-3156 (Heap-Based Buffer Overflow in Sudo)

[Matt Compton]

I agree it should be a message. I'm curious though, about how often you
update on the server side? By the time I got the announcement the core repo
had pushed that version to me already.

On Fri, Jan 29, 2021 at 12:26 PM Łukasz Michalski via arch-general <
arch-general at lists.archlinux.org> wrote:

> Hi,
>
> Just checked my servers and all were vulnerable:
>
> [zork at archdevel ~]$ sudoedit -s '\' `perl -e 'print "A" x 65536'`
> malloc(): corrupted top size
> Aborted (core dumped)
>
> Updating to the latest version (sudo-1.9.5.p2-1) closed this
> vulnerability. Maybe this should be posted as arch news message?
>
> Regards,
> Łukasz
>